This Privacy Policy applies to the mobile application Testdroid Quiz free (com.mlcorrea.testdroidfree), developed by mlcorrea and operated under the brand CramSnap (“we”, “our”, “us”). We respect your privacy. This policy explains how we collect, use, and protect your data when you use our mobile application.

1. Information We Collect

1.1 Account Information

Email address — when you sign up or log in
Display name — your chosen username
Google account token — for Google Sign-In authentication

1.2 Data You Create

Quizzes — questions, answers, categories you create and share
Quiz results — your scores, completion status, time taken
Community content — comments, ratings, shared quizzes

1.3 Usage Data

App interaction events — quiz starts, completions, AI generation usage, battle activity (collected via Firebase Analytics)
Device information — device model, OS version (anonymized)
Crash reports — technical data when the app crashes (collected via Firebase Crashlytics)
Daily streak data — app open dates, streak count (stored locally and synced to your account)

1.4 Data We Do NOT Collect

We do NOT collect your AI API keys — they are stored locally on your device only
We do NOT access your photos, camera, or files except when you explicitly use the document scanner feature
We do NOT track your location
We do NOT sell your data to third parties

2. How We Use Your Data

Provide and improve the CramSnap service
Sync your quizzes and progress across devices
Enable community features (sharing, battles, leaderboards)
Send push notifications (streak reminders, battle challenges) — you can disable these in app settings
Analyze usage patterns to improve the app (anonymized via Firebase Analytics)
Detect and fix crashes (via Firebase Crashlytics)

2.1 AI Generation: Two Modes

CramSnap offers two ways to generate quizzes with AI:

CramSnap AI (default). Your prompt — the topic or text you submit, and any document you upload for transcription — is sent to our servers and processed by Google Gemini on our behalf, as our service provider. This content is used to generate your quiz and is subject to Google’s terms for its API services.

Your own key (BYOK). When you add your own API key (e.g., Google Gemini, Groq), it is:

Stored locally on your device only
Never transmitted to our servers
Used directly by your device to communicate with the AI provider
Subject to the AI provider’s own privacy policy

Requests made with your own key do not pass through our servers.

2.2 AI Prompt Records (Abuse Prevention)

To protect the shared AI service and comply with our providers’ usage policies, prompts submitted to CramSnap AI are recorded and linked to your account. We use these records only to investigate misuse, enforce our content rules, and keep AI generation available for everyone.

Ordinary prompt records are kept for 180 days
Records flagged by AI safety systems, or belonging to reported content, are kept for 365 days
If several of your requests are refused by the AI provider’s safety systems in a single day, AI generation may be paused automatically for your account until the next day. This is an automated protective measure: it affects only AI generation, nothing else in your account, and can be reviewed by contacting support.
Requests made with your own key (BYOK) are not recorded

3. Advertising

CramSnap uses Google AdMob to show advertisements. AdMob may collect your device’s Advertising ID (AAID), approximate region (derived from your IP address), and usage data to serve and measure ads.

This data is governed by Google’s Privacy Policy and Advertising Privacy controls.

EU, UK and EEA users: When you first open CramSnap, a consent dialog powered by Google’s User Messaging Platform (UMP) asks whether you agree to personalised ads. Your choice is stored on your device. You can withdraw your consent at any time via app settings or by contacting us.

All regions: You can opt out of personalised ads by resetting your Advertising ID in your device settings (Android: Settings → Privacy → Ads → Reset advertising ID).

We only share data with:

Firebase (Google) — for authentication, analytics, crash reporting, and push notifications
AdMob (Google) — for serving advertisements
Other users — only the content you explicitly share (quizzes, comments, ratings, battle challenges)

We do NOT sell, rent, or trade your personal data.

5. Data Retention

Your account data is retained while your account is active
Analytics data is retained for up to 2 months
Crash reports are retained for 90 days (Firebase Crashlytics default)
AI prompt records (CramSnap AI) are retained for 180 days; records flagged by safety systems or tied to reported content for 365 days (see §2.2 and §5.3)
When you delete your account, your personal data is removed immediately; any shared content kept for other users is anonymised at the same time. See the next two sections for details.

5.1 What happens to content you’ve shared

When you delete your account, we permanently remove your personal information — name, email, profile photo, friends list, gameplay history, daily streaks, coin balance, purchases and login credentials.

Content you have shared with other users — quizzes used in a tournament, quizzes assigned to a teacher’s class, or quizzes other users are currently playing — will remain available to those users so their experience isn’t broken. In all of those places, your name is replaced with “Deleted user” so the content can no longer be linked back to you.

This retention is based on the legitimate interests of other users (Article 6(1)(f) GDPR) and on the carve-outs in Article 17(3)(a) and (e) of the GDPR. Quizzes you created that aren’t being used by anyone else are deleted in full.

If a specific piece of your content contains information you want removed — for example, your name in a quiz title or a question you wrote — contact us at [email protected] and we’ll review the request individually.

5.2 Operational data kept briefly after deletion

Hashed copy of your email — 20 days. A one-way hash (SHA-256) of your email is stored so you can’t immediately re-register with the same address. This is an anti-abuse measure. After 20 days the hash is removed and the email can be used again. A different email address can be used at any time.
Analytics events — up to 2 months. Anonymous gameplay events tagged with your account identifier while you were signed in. The device-side identifier is cleared the moment your account is deleted, so no new events are linked to you.
System logs — up to 90 days. Server-side audit logs of significant events (sign-in, account deletion, security events) for fraud detection and legal-claim defence.

See our Data Deletion page for the full breakdown.

5.3 AI prompt records after deletion or a ban

When you delete your account, ordinary AI prompt records are deleted with it. Records that were flagged by AI safety systems, or that belong to content under a moderation report, are pseudonymised instead: your account identity is removed from them, and they expire within 365 days of their creation.

If an account is banned for abuse of the AI service, its prompt records are likewise pseudonymised and retained for up to 365 days as evidence supporting the enforcement action. This retention is based on our legitimate interest in preventing abuse of the service (Article 6(1)(f) GDPR) and the exemptions in Article 17(3) GDPR.

As a user in the UK/EEA, you have the right to:

Access — request a copy of your data by emailing us
Rectification — correct inaccurate data
Erasure — delete your account (Settings → Delete Account). See our Data Deletion page for what happens to personal data versus content shared with others
Data Portability — request a copy of your quizzes and account data by emailing us
Object — opt out of analytics tracking
Withdraw Consent — at any time via app settings or by contacting us

7. Data Security

We implement industry-standard security measures:

Authentication via JWT tokens (JSON Web Tokens)
All API communication encrypted via HTTPS/TLS
Firestore security rules prevent unauthorized data access
Account deletion permanently removes personal data and anonymises any shared content (see §5.1)

8. Children’s Privacy

CramSnap is directed at users aged 13 and over. It is not designed for children under 13.

The app’s classroom and assignment features are intended for teacher-led use with secondary-school students (ages 13+) and adult learners, not for primary-school children.

We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided data, we will delete it promptly and remove the account.

As a precaution for younger users in our target audience, CramSnap configures Google AdMob to request non-personalised advertisements for all users in the EU, UK and EEA, regardless of age. This complies with GDPR-K (the under-age-of-consent variant of GDPR) and Google Play’s Families Policy requirements.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via the app or email. Continued use after changes constitutes acceptance.

10. Contact Us

For privacy-related questions or requests:

Email: [email protected]
Data Controller: mlcorrea (Manuel L trading as CramSnap.app)

Privacy Policy